Professional Pen Testing for Web Applications (Programmer to Programmer)

Author - Andres Andreu ... [Goo?] [Posters]

This Paperback Book item from Wrox was reviewed on 20-Oct-2008.

Search ISBN:0471789666 offer from Abebooks or used books from Alibris. Professional Pen Testing for Web Applications (Programmer to Programmer) Reference Book. Classifications : Privacy Business & Culture Computers & Internet Subjects Books General Networks, Protocols & APIs Networking Computers & Internet Subjects Books Network Security Networking Computers & Internet Subjec . Click the following link to view the cover of Professional Pen Testing for Web Applications (Programmer to Programmer).

Related topics: Privacy. Business & Culture. Subjects. Books. General. Networking. Subjects. Books. Network Security. Networking.

1) Paperback Book Professional Pen Testing for Web Applications (Programmer to Programmer) by Wrox. For the last 9 years I had been working daily in security tasks, (no managerial position!) in multiple tasks IDS, Firewalls, Switches, and had been exposed with multiple flavors of security products. From Open Source to Windows. Working with the products! In our arena we need security books references that will help us improve our analytical skills, and let us know what is out there. The field is very dynamic and nobody holds the torch of "guru" in this arena (Even thou many claim it!). Very very few books excel in quality of delivery, and comprehension. And understand our day to day security jobs. This book is one of the few books I recomend for your average security guy, that needs help to understand what is behind the scene in the web network traffic. Go ahead and buy this book. Its worth it.¤

2) Paperback Book Professional Pen Testing for Web Applications (Programmer to Programmer) by Wrox. Just a quick note about this book; the book was entertaining enough to keep you interested and contained alot of useful and practical information. Recommend for anyone who is a IT professional entering into a pen testing role and any web developer.¤

3) Paperback Book Professional Pen Testing for Web Applications (Programmer to Programmer) by Wrox. Awesome book on Pen Testing!! I believe this is right up there with Richard Bejtlich´s books. Great examples and very 3D. I highly recommend this book to ANY hands on security folks out there at all levels of skill.¤

4) Paperback Book Professional Pen Testing for Web Applications (Programmer to Programmer) by Wrox. I recently received copies of Hacking Exposed: Web Applications, 2nd Ed (HE:WA2E) by Joel Scambray, Mike Shema, and Caleb Sima, and Professional Pen Testing for Web Applications (PPTFWA) by Andres Andreu. I read HE:WA2E first, then PPTFWA. Both are excellent books, but I expect potential readers want to know which is best for them. I could honestly recommend readers buy either (or both) books. Most people should start by reading HE:WA2E, and then fill in gaps by reading PPTFWA.

Before proceeding I should note I used to work with the two ex-Foundstone authors of HE:WA2E, although I haven´t been afraid in the past to review books honestly.

First, I must say PPTFWA was published in the right series. The motto "Programmer to Programmer," and the term "Professional" in the title, clearly apply to this book. Author Andres Andreu takes his work very seriously, sometimes at the expense of the non-programming network security crowd. You will feel welcome if you are a programmer/security person, but maybe not if you work with "edge devices" like firewalls, IDS, and so on. Given this stance, I found it ironic that PPTFWA´s advice (on p 220) for dealing with such impediments is "[m]ake sure your client disables these." Despite the author´s focus on application security, he still notes (on p 425) "edge-level protective steps are interesting because they can provide the same level of protection to multiple Web applications simultaneously... [t]his is important because many times you will be faced with a Web application that needs remediation, but the stakeholders will not allow anyone to touch it at the core." Exactly!

PPTFWA´s strengths lie in the depth it covers certain subjects. For example, its discussions of Web Services are very strong, easily better than HE:WA2E. PPTFWA introduces a wider variety of tools than HE:WA2E, many of which were totally new to me. Even tools without a strict security use (e.g., Twill) are shown to have powerful assessment features. (I liked the hints on p0f in Ch 3, and I use p0f with Sguil.) I like the examples of real cross-site scripting attacks in Ch 4 and the case studies in several parts of the book.

PPTFWA deserves credit for two other features. First, the book covers report writing, especially identification and removal of false positives. This is critical yet not often mentioned elsewhere. Second, the book links to a VMware image built by the author containing vulnerable Web app software. This is exceptional and much appreciated.

I couldn´t give PPTFWA five stars for two reasons. First, I didn´t think the book was as well-organized as HE:WA2E. One of the other reviews mentions this fact. Signs of weak structure include repeating or rephrasing material, or wondering why a chapter is placed (e.g., Ch 5?).

Second, I found conceptional problems with PPTFWA that are unfortunately not limited to this book; i.e, they often appear in Web app security community discussions. On p 5 the author writes "truly thorough defensive postures can always beat out the offense in these scenarios because there will just be an easier target elsewhere." I disagree, especially when targeted attacks or insiders are at work. Speaking of insiders, on p 11 we read that FBI and CSI reports say "a majority of attacks [come] from inside." This isn´t true either, and hasn´t been for many years (if it were ever true at all).

I found the author´s use of the terms threat and vulnerability to be all over the map. For example, p 191 says "Threats that are identified as unresolved become vulnerabilities. Vulnerability is also present when a threat exists and the steps to mediate it have not been implemented." This is just wrong; vulnerabilities exist despite the presence or absence of threats. Risk exists when a vulnerability is present, a threat has the capabilities and intentions to exploit it, and an asset has value. Furthermore, much of the "threat" talk in PPTFWA is built on the flawed characterizations of mostly attacks and vulnerabilities found in WASC and OWASP documents. It would have been great for PPTFWA to build on these technically exceptional but terminologically challenged guides by wrapping them with a sound risk, threat, vulnerability, asset, and attack framework.

Aside from these issues (which bother me but can be ignored in favor of technical material) I really liked PPTFWA. I think the book is an example of the sort of higher-end book we should expect to see from good security authors in the future. There is much more to digital security than Web applications, although you might not feel that way when reading PPTFWA. Nevertheless, I consider PPTFWA a must-read after HE:WA2E.¤

5) Paperback Book Professional Pen Testing for Web Applications (Programmer to Programmer) by Wrox. First things first, this book is not intended for newbies... That being said, this is by far the most comprehensive guide to application security that exists today. No other books out there can give you the depth and practical security knowledge that is presented here.

Anyone that is serious about application security will find this book to be a great tool to augment their existing skillset...

Anyone who thinks that they know security because they run traditional network firewalls and/or IDS/IPS systems will find this book eye opening!!!¤

6) Paperback Book Professional Pen Testing for Web Applications (Programmer to Programmer) by Wrox. There is no such thing as "perfect security" when it comes to keeping all systems intact and functioning properly. Good penetration (pen) testing creates a balance that allows a system to be secure while simultaneously being fully functional. With this book, you´ll learn how to become an effective penetrator (i.e., a white hat or ethical hacker) in order to circumvent the security features of a Web application so that those features can be accurately evaluated and adequate security precautions can be put in place.

After a review of the basics of web applications, you´ll be introduced to web application hacking concepts and techniques such as vulnerability analysis, attack simulation, results analysis, manuals, source code, and circuit diagrams. These web application hacking concepts and techniques will prove useful information for ultimately securing the resources that need your protection.

What you will learn from this book
* Surveillance techniques that an attacker uses when targeting a system for a strike
* Various types of issues that exist within the modern day web application space
* How to audit web services in order to assess areas of risk and exposure
* How to analyze your results and translate them into documentation that is useful for remediation
* Techniques for pen-testing trials to practice before a live project

Who this book is for

This book is for programmers, developers, and information security professionals who want to become familiar with web application security and how to audit it.

Wrox Professional guides are planned and written by working programmers to meet the real-world needs of programmers, developers, and IT professionals. Focused and relevant, they address the issues technology professionals face every day. They provide examples, practical solutions, and expert education in new technologies, all designed to help programmers do a better job.¤

Page Updated: Robert N. Goolsby, 17-Nov-2008, 04717896669780471789666, 900-400-780-660-140-431-8

Professional Pen Testing for Web Applications (Programmer to Programmer), Book, Image © Wrox

Search: Wrox, Book Posters, Book Art